Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-70534

git plugin not cloning properly since monday(30 Jan 2023)

    • Icon: Bug Bug
    • Resolution: Not A Defect
    • Icon: Blocker Blocker
    • git-plugin
    • None

      git plugin not cloning properly since monday(30 Jan 2023)

       

      It's working fine if we are trying with last week jenkins image. But with the latest jenkins image, git clone is giving us the below error. When comparing the jenkins images, we don't see any changes in git plugin version or any other major image changes to be dealt with. All permissions to Bitbucket seems fine & if we clone via sh command git, it working fine. Problem is only if we try using the git plugin for cloning as shown below

      git credentialsId: '', url: 'ssh://git@bitbucket..net:7999/test-prototype/aws--*-seeder.git'

       
      ERROR: Error cloning remote repo 'origin'
      hudson.plugins.git.GitException: Command "git fetch --tags --force --progress – ssh://git@bitbucket..net:7999/cloudpb-prototype/aws-pb-testkins-seeder.git +refs/heads/:refs/remotes/origin/*" returned status code 128:
      stdout:
      stderr: fatal: detected dubious ownership in repository at '/var/jenkins_home/workspace/AWS/Platform/Jobs_Seeder/seeder@script/c8bd8428ea64a1e1a5a4c84e7d3a6c16da4e6efbf6dac0abd7f818e2f7c263bd'
      To add an exception for this directory, call:

      git config --global --add safe.directory /var/jenkins_home/workspace/AWS/Platform/Jobs_Seeder/seeder@script/c8bd8428ea64a1e1a5a4c84e7d3a6c16da4e6efbf6dac0abd7f818e2f7c263bd

          [JENKINS-70534] git plugin not cloning properly since monday(30 Jan 2023)

          Venkatesh added a comment -

          No, we checked that as well.  Container is running as Jenkins user only. We did id command & checked it.

           

          Problem is when we clone via sh its working, problem comes only when doing git SCM

           

          Venkatesh added a comment - No, we checked that as well.  Container is running as Jenkins user only. We did id command & checked it.   Problem is when we clone via sh its working, problem comes only when doing git SCM  

          Mark Waite added a comment -

          Step by step instructions so that others can duplicate the issue?

          Mark Waite added a comment - Step by step instructions so that others can duplicate the issue?

          Venkatesh added a comment -

          Simple, we are unable to perform the below command. First time it says dubious permission, second time when we build it says not a git directory. It works after we add the safe folder & chown permission. But ideally these extra efforts are not needed before.  Safe folder can't be added before in automated builds because we are creating a random workspace folder. So now need help in fixing this. If required we can connect via google meet & i can explain you clearly. Jenkins container is running as jenkins used with uid 1000. There are no any such permission issues because it was working till last week. ONly in the latest image its not working. 

           

          Below is the command we performed

           

          git credentialsId: '****', url: 'ssh://git@bitbucket.xxx.net:7999/project-prototype/aws-pb-testkins-seeder.git'

          Jenkins Env Details : Jenkins 2.375.2

          All Plugins are latest version.

           

          Note : if we do simple git clone using shell command the same repo gets cloned.

           

           

          Venkatesh added a comment - Simple, we are unable to perform the below command. First time it says dubious permission, second time when we build it says not a git directory. It works after we add the safe folder & chown permission. But ideally these extra efforts are not needed before.  Safe folder can't be added before in automated builds because we are creating a random workspace folder. So now need help in fixing this. If required we can connect via google meet & i can explain you clearly. Jenkins container is running as jenkins used with uid 1000. There are no any such permission issues because it was working till last week. ONly in the latest image its not working.    Below is the command we performed   git credentialsId: '****', url: 'ssh://git@bitbucket.xxx.net:7999/project-prototype/aws-pb-testkins-seeder.git' Jenkins Env Details : Jenkins 2.375.2 All Plugins are latest version.   Note : if we do simple git clone using shell command the same repo gets cloned.    

          Venkatesh added a comment -

          Saw the below one in internet.. is this one of the reason??

           

          Cause

          A change was introduced in git 2.35.2 (and newer) to prevent a user from executing git commands in a repository owned by a different user. This is to address a security risk, CVE-2022-24765,  for more details see setup_git_directory and Git security vulnerability announced. The change to setup_git_directory prevents git invocations from executing commands on a repository owned by another user.

          Venkatesh added a comment - Saw the below one in internet.. is this one of the reason??   Cause A change was introduced in git 2.35.2 (and newer) to prevent a user from executing  git  commands in a repository owned by a different user. This is to address a security risk,  CVE-2022-24765 ,  for more details see  setup_git_directory  and  Git security vulnerability announced . The change to setup_git_directory prevents  git  invocations from executing commands on a repository owned by another user.

          Mark Waite added a comment -

          venkatd4u yes, that's the reason as far as I can tell. That's the reason that is mentioned in the seven links that I included in my earlier comment and is the reason reported in JENKINS-70521

          Mark Waite added a comment - venkatd4u yes, that's the reason as far as I can tell. That's the reason that is mentioned in the seven links that I included in my earlier comment and is the reason reported in JENKINS-70521

          Venkatesh added a comment -

          Fix which is working is we need to perform this command 

          git config --global --add safe.directory *

          But problem is doing this in job dsl pipeline creation using definition - cpsscm- git -remote one. We are trying to execute the remote script.

          But even the working CLI is having the same GIT CLI version of 2.30.2. Its still not convincing enough what exactly is the issue & what has changed from previous working image.

           

          Venkatesh added a comment - Fix which is working is we need to perform this command  git config --global --add safe.directory * But problem is doing this in job dsl pipeline creation using definition - cpsscm- git -remote one. We are trying to execute the remote script. But even the working CLI is having the same GIT CLI version of 2.30.2. Its still not convincing enough what exactly is the issue & what has changed from previous working image.  

          Venkatesh added a comment -

          Please guide if we can upgrade the above git cli to some version where we will not face this issue.

          Venkatesh added a comment - Please guide if we can upgrade the above git cli to some version where we will not face this issue.

          Venkatesh added a comment -

          https://github.com/actions/runner-images/issues/6775

           

          Above document clearly says that there is an unknown bug with regards to this. Its not something new which im reporting. Im currently facing unable to add that temp fix of safe folder also in job dsl. 

          Venkatesh added a comment - https://github.com/actions/runner-images/issues/6775   Above document clearly says that there is an unknown bug with regards to this. Its not something new which im reporting. Im currently facing unable to add that temp fix of safe folder also in job dsl. 

          Venkatesh added a comment -

          For time being, we fixed the issue with below workaround by doing the below command in dockerfile

           
          RUN git config --system --replace-all safe.directory '*'
           
           

          Venkatesh added a comment - For time being, we fixed the issue with below workaround by doing the below command in dockerfile   RUN git config --system --replace-all safe.directory '*'    

          Mark Waite added a comment -

          Not an issue that the git plugin can resolve. When command line git detects incorrect ownership, it is unlikely that the git plugin would be allowed to change the ownership.

          Mark Waite added a comment - Not an issue that the git plugin can resolve. When command line git detects incorrect ownership, it is unlikely that the git plugin would be allowed to change the ownership.

            Unassigned Unassigned
            venkatd4u Venkatesh
            Votes:
            4 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: